Apache Thrift: Nine DoS and Info Disclosure Vulnerabilities Disclosed Together
Nine vulnerabilities impacting Apache Thrift, primarily DoS and information disclosure, were disclosed together between July 27-28, 2026.
Key findings
- Nine vulnerabilities disclosed for Apache Thrift between July 27-28, 2026.
- Multiple DoS vulnerabilities affect Python, C++, Node.js, and Ruby bindings.
- Information disclosure and host mismatch flaws also present in the batch.
- CVSS scores range from moderate (6.5) to important (7.5).
- Upgrade to Apache Thrift 0.24.0 to address these issues.
On July 27-28, 2026, a batch of nine vulnerabilities was disclosed for Apache Thrift, a widely used cross-language service development framework. The vulnerabilities, primarily impacting denial of service (DoS) and information disclosure, were reported across various Thrift bindings including Python, C++, Node.js, and Ruby. The disclosures highlight potential risks for applications relying on Thrift for inter-process communication.
Several vulnerabilities center on denial of service through various mechanisms. CVE-2026-55969 and CVE-2026-49158 detail DoS risks via integer overflow/wraparound and improper handling of highly compressed data, respectively. Similarly, CVE-2026-55968 and CVE-2026-48586 point to DoS vulnerabilities stemming from inefficient algorithmic complexity and resource allocation, and improper handling of highly compressed data in Node.js and Ruby bindings. CVE-2026-45112 and CVE-2026-41608 address DoS through uncontrolled resource allocation and data amplification in the Python bindings.
Beyond DoS, information disclosure and host mismatch vulnerabilities were also part of this disclosure batch. CVE-2026-58023 and CVE-2026-55970 describe information disclosure and DoS due to out-of-bounds reads in the general Thrift implementation and C++ bindings. A specific vulnerability, CVE-2026-66053, which replaces CVE-2026-41603, involves an improper validation of certificates with host mismatch in the Python bindings.
The majority of these vulnerabilities were disclosed on July 27, 2026, with one additional vulnerability reported on July 28, 2026, indicating a coordinated disclosure event. The severity of these issues ranges from moderate (CVSSv3 6.5) to important (CVSSv3 7.5).
Apache Thrift version 0.24.0 is recommended as the fix for the disclosed vulnerabilities, particularly addressing CVE-2026-66053. Users are strongly advised to upgrade to this version to mitigate the risks associated with these security flaws. The batch of disclosures underscores the importance of keeping the Thrift framework updated to protect against potential service disruptions and information leaks.